Repository navigation
is the keycloak-servlet filter as well being deprecated #11790
Replies: 7 comments 9 replies
|
Ah.. had a second look here https://www.keycloak.org/2022/02/adapter-deprecation.html , the servlet filter is not being deprecated. |
|
The SAML servlet filter will remain, but the OIDC servlet filter is planned to be removed. |
|
What's the alternative for oidc srvlet filter ( for non spring application)
Sent from Yahoo Mail on Android
On Wed, 4 May 2022 at 4:33 pm, Stian ***@***.***> wrote:
The SAML servlet filter will remain, but the OIDC servlet filter is planned to be removed.
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you authored the thread.Message ID: ***@***.***>
|
|
quick look at various alternatives suggests google oauth 2 client library for servlets (https://developers.google.com/api-client-library/java/google-oauth-java-client/setup) there are few others form other oauth providers like https://auth0.com/docs/quickstart/webapp/java/01-login or oktas (https://github.com/okta/okta-auth-java) etc.. @stianst I think it might be worth while maintaining the kyecloak servlet libraries which is fully compatible with keycloak.. Let me know your opinion. |
|
We are not able to maintain the servlet filter beyond what is laid out in https://www.keycloak.org/2022/03/releases. The cost of maintaining this is very big compared to the limited number of users. An option is of course to extract the servlet filter (and any other adapters) into a separate community maintained repository if anyone wants to maintain this beyond March/April 2023. |
|
Thanks @ssilvert , maintaining it for a longer time and maybe updating to the jakarta namespace (package) instead of javax would be great for us. |
|
@stianst even I would very much like to have OIDC servlet filter maintained for long term. |
|
Hi @stianst Was going through this discussion and understood about keycloak's plan to discontinue suport for oidc-servlet client libraries. |
i see quarkus3 branch already doing it |
|
I did some more digging around the servlet filter deprecation , I think this will impact the following use cases Many of the K_ events /back channel logout , logout propogation etc.. and even multitenancy Also there are host of client adapter settings which are not directly portable/compatible Many applications still uses tomcat/servlet etc.. Unfortunately, There is no good generic replacment library avaialble for oidc-servlet-filter in my opinion. :( |
|
You are right. We have the same problem. At the moment, we plan to migrate our applications from tomcat/tomee to wildfly for this reason. |
|
Thanks for all the inputs. Based on feedback we have decided to revise our plans around adapter deprecation and removal. For the updated plans please see https://www.keycloak.org/2023/03/adapter-deprecation-update.html. |
|
Thanks @stianst much appriciated .It was really kind of you to revaulate the plan and to offer support for these adapters a while more! |
|
Maybe this is a solution, at least if you only want to protect an endpoint https://github.com/curityio/oauth-filter-for-java |
Uh oh!
There was an error while loading. Please reload this page.
I use this keycloak adapter https://github.com/keycloak/keycloak/tree/main/adapters/oidc/servlet-filter
It was not very clear where this one is getting deprecated or not. Can some one please clarify.
In case this is being deprecated, what is the alternative one should consider?
All reactions